diff --git a/.github/workflows/macos-unit.yml b/.github/workflows/macos-unit.yml
index d3bef63..76489df 100644
--- a/.github/workflows/macos-unit.yml
+++ b/.github/workflows/macos-unit.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
 
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index d91ec23..9912a85 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -66,16 +66,16 @@ jobs:
     steps:
 
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
           persist-credentials: false
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@7c619efba910c04005a835b110b057fc28fd6e93 # v3.2.0
+        uses: pypa/cibuildwheel@adba99c781d3746d38b3a09b1cf797965bcb7fe6 # v4.3.0
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wheels-cloud-${{ matrix.os }}
           path: ./wheelhouse/*.whl
@@ -89,13 +89,13 @@ jobs:
 
     steps:
       - name: Download wheels from cloud runners
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: wheels-cloud-*
           merge-multiple: true
           path: wheels
 
-      - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }} # zizmor: ignore[use-trusted-publishing] Trusted Publishing is not yet configured on PyPI
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index c296472..ac4438d 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout private repo
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout public repo
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/ubuntu-asan.yml b/.github/workflows/ubuntu-asan.yml
index a08c42d..9dcd231 100644
--- a/.github/workflows/ubuntu-asan.yml
+++ b/.github/workflows/ubuntu-asan.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
 
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
diff --git a/.github/workflows/ubuntu-coverage.yml b/.github/workflows/ubuntu-coverage.yml
index bd54fe2..88d8a3c 100644
--- a/.github/workflows/ubuntu-coverage.yml
+++ b/.github/workflows/ubuntu-coverage.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
@@ -62,7 +62,7 @@ jobs:
         working-directory: build_dir
 
       - name: upload coverage to codecov
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           directory: build_dir
diff --git a/.github/workflows/ubuntu-no-sse.yml b/.github/workflows/ubuntu-no-sse.yml
index 6e6acf8..c3c69df 100644
--- a/.github/workflows/ubuntu-no-sse.yml
+++ b/.github/workflows/ubuntu-no-sse.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
 
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
diff --git a/.github/workflows/ubuntu-python.yml b/.github/workflows/ubuntu-python.yml
index 4d2a2e5..f367b97 100644
--- a/.github/workflows/ubuntu-python.yml
+++ b/.github/workflows/ubuntu-python.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
@@ -38,7 +38,7 @@ jobs:
           sudo apt -y install libboost-iostreams-dev libboost-program-options-dev zlib1g-dev
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           architecture: x64
diff --git a/.github/workflows/ubuntu-regression.yml b/.github/workflows/ubuntu-regression.yml
index 905f37d..2c4bc07 100644
--- a/.github/workflows/ubuntu-regression.yml
+++ b/.github/workflows/ubuntu-regression.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
diff --git a/.github/workflows/ubuntu-unit.yml b/.github/workflows/ubuntu-unit.yml
index 19b5c52..bdf7ac8 100644
--- a/.github/workflows/ubuntu-unit.yml
+++ b/.github/workflows/ubuntu-unit.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
 
       - name: checkout repo & submodules
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
diff --git a/.github/workflows/zizmor-audit.yml b/.github/workflows/zizmor-audit.yml
index ae0d2af..27d8a06 100644
--- a/.github/workflows/zizmor-audit.yml
+++ b/.github/workflows/zizmor-audit.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false